April 21 – 3 New Vulns | CVE-2023-2136, CVE-2023-27350, CVE-2023-28432
In this CISA KEV Breakdown, three vulnerabilities were added: A Chrome 0-day, a MinIO info disclosure vulnerability and a pair of 0-days in PaperCut allowing for authentication bypass and remote code execution.
CVE ID | Vendor/Project | Software | Exploitation Consequence | GreyNoise Traffic | EPSS Score | EPSS Percentile | Due Date |
CVE-2023-2136 | Chrome | Code Execution | 0.00109 | 42.41% | 05/12/2023 | ||
CVE-2023-27350 | PaperCut | MF/NG | Code Execution | 0.00311 | 65.55% | 05/12/2023 | |
CVE-2023-2842 | MinIO | MinIO | Information Disclosure | 18 | 0.01489 | 84.87% | 05/12/2023 |
Notable Vulnerability Additions
CVE-2023-2136 | ChromeOS Integer Overflow
A vulnerability in the open-source graphics library Skia prior to 112.0.5615.137 was discovered by Clément Lecigne, part of Google’s Threat Analysis Group on April 12. Considered high-severity, full access to the details of exploitation are being restricted by Google until a majority of users have been updated to an unaffected version. According to the information available, this vulnerability appears to utilize a maliciously crafted web page that a user would interact with to exploit. At time of writing, no exploitation code appears to be available, however Google has indicated they are aware of exploitation in the wild in their channel update, resulting in it’s addition to the KEV.
Security Advisory:
https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html
CVE-2023-27350, CVE-2023-27351 | PaperCut Auth Bypass -> Remote Code Execution
Two 0-day vulnerabilities that together resulted in remote code execution for an attacker were discovered in PaperCut NG versions 8.0 and above, and prior to 20.1.7, 21.2.11, or 22.0.9. CVE-2023-27351 does not appear to have been added to the KEV, but is alongside CVE-2023-27350 in actively observed exploitation. The two vulnerabilities were only exploitable upon the attacker bypassing authentication, which is trivial due to the SetupCompleted page including a Login button that logs the user in. This vulnerability appears to be considered CVE-2023-27350 whereas CVE-2023-27351 is the ability for the attacker to configure the app to allow for code execution.
Once the attacker lands on this page and uses the button, they can manipulate the settings to allow for injecting code to execute on the affected machine. Organizations are recommended to ensure they do not have a public-facing PaperCut server and if so, enabling access control. Organizations should also monitor for suspicious activity surrounding the pc-app.exe process. For more information on how the vulnerabilities were exploited and related detection efforts, see this Huntress report.
Security Advisory:
https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
CVE-2023-28432 | MinIO Information Disclosure
A vulnerability exists in MinIO RELEASE.2022-03-17 which can allow for information disclosure including the dumping of all environment variables on the affected device. This specific release saw much attention due to the OpenAI for developers code examples utilizing this vulnerable version of MinIO for their docker image in their repository. The issue as well as active exploitation were reported by GreyNoise and you can read more of their report here. You can also view their tag that has been launched to observe exploitation activity. Organizations are recommended to ensure that a supply chain security tool such as docker-cli-scan is utilized to ensure vulnerabilities such as this are detected.
Security Advisory:
https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
← April 19, 2023 CISA Kev Breakdown
Click here to expand our CISA KEV Breakdown Frequently Asked Questions
- What makes for a notable addition?
- A notable addition can arise from many different characteristics. If a particular vulnerability is notable to the security community or a subset of the security community or if the EPSS score reveals notable information about the vulnerability, this can constitute further analysis. It may also be the case that a particular vulnerability shines a light on everyday users and we will highlight important information and key takeaways to ensure users and readers have easy access to actionable information.
- When is the Breakdown released?
- We aim to have our analysis of each KEV update posted within 24 hours of the time in which the Catalog is updated. See CISA’s full catalog here
- I am not bound by BOD 22-01 or federal regulations, why should the KEV concern me?
- CISA encourages all organizations to utilize the Catalog as an attribute in your vulnerability prioritization framework. Organizations looking to lessen the scope on known dangerous vulnerabilities and make a goal to remediate them can understand where they currently stand against what CISA has confirmed as exploited vulnerabilities in the wild. See CISA’s section on “How should organizations use the KEV catalog?” here.
- What is EPSS?
- EPSS is the Exploit Prediction Scoring System. It is an open, data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild. See the EPSS home page on FIRST for more information here.
- What is the difference between EPSS probability and EPSS percent?
- EPSS probability is the risk calculated by the model when determining the perceived threat of the vulnerability itself. Percentage is a relative comparison of the rest of the CVEs within the given sample. While the probability only changes upon refreshing the results from the model, the percentage can change purely based on the CVE sample given. In the case of the Breakdown, we use the percentage given by the pool of all CVEs with given EPSS data. Scores may vary post-release of the post given new information about the vulnerabilities and their perceived threat. For more information on applying and understanding EPSS data, see this article on the FIRST website, as well as their FAQ page.
- What is GreyNoise?
- GreyNoise is a platform that collects, analyzes, and labels data on IPs that scan the internet and saturate security tools with noise. Through their sensor network, GreyNoise observes vulnerability exploitation attempts for vulnerabilities that are exploited in the wild over the Internet. These are arguably vulnerabilities that should be at the very top of your priority list to remediate.
- Why are GreyNoise exploitation attempts only observed on ~20% of KEV vulnerabilities?
- Exploitation of many vulnerabilities in the CISA KEV will not be observed for many reasons that GreyNoise does a good job of explaining in this post. For example:
- The vulnerability may not be remotely exploitable
- Vulnerability exploitation may require authentication (and result in privilege escalation)
- The impacted software may not be exposed to the internet
- Mass scanning/exploitation is not occurring yet
- Exploitation of many vulnerabilities in the CISA KEV will not be observed for many reasons that GreyNoise does a good job of explaining in this post. For example: